----BEGIN CLASS---- [17:36] #startclass [17:36] Roll Call [17:36] Ritik Raushan [17:36] sparsh [17:36] vibhor [17:36] Mrinal Raj [17:36] Abhay Kaushik [17:36] Aniruddha Basak [17:36] Abhishek kumar [17:36] Kuntal Majumder [17:36] Kanay bhandari [17:36] Kurian Benoy [17:36] Jagannathan Tiruvallur Eachambadi [17:37] Nilesh Patra [17:37] Pravar Agrawal [17:37] Siddhant N Trivedi [17:37] Ankur [17:37] kumar Prateek [17:37] Pritam [17:37] Rayan Das [17:38] We have a good number of students today [17:38] \o/ [17:39] Bhavesh Gupta [17:39] everyone read the link I gave yesterday? [17:39] Yes :) [17:40] yes [17:40] yes [17:40] yes [17:40] I couldn't finish full rfc [17:40] not completed yet. [17:40] not completed [17:40] Not completed yet [17:40] not completed yet [17:40] not completed [17:40] Not fully yet [17:41] Not completely read [17:41] Okay [17:41] not completed yet [17:41] No problem :) [17:41] Not completed [17:41] Any questions from yesterday's class other than architecture/how how it works question? [17:42] ! [17:42] ! [17:42] ! [17:42] next [17:43] Main applications of SSH in the current world other than getting into other computers? [17:43] ! [17:43] that's the only one I know [17:44] At the end, SSH is a protocol that establishes a secure connection between a client and a server computer [17:44] on top of that we have a bunch of applications made [17:45] a good example would ansible [17:45] next [17:45] what other job a tunnel will have other than letting things pass through :) pretty much [17:45] Does ssh only works for networking or we can secure file/data sharing too?? [17:46] katek_warren: yes, scp, rsync uses the ssh protocol for sharing files from one server to another [17:46] next [17:46] if we create different ssh key-pair for each account then do we need to create different ssh key-pair for each devices. For example your pc , laptop, office laptop? [17:46] BhaveshSGupta: ideally yes [17:47] ! [17:47] next [17:47] okay, [17:47] question asked already [17:47] next [17:47] sayan: you told for different accounts create different ssh-keys? Should I do for all email-ids corresponding to ssh-keys? [17:48] someone else wants to answer this question? ^^ [17:49] no one? [17:49] Nope only the you require [17:50] my ssh keys don't even have the real email, just username@host default. That is just an identifier so don't worry about it [17:50] email is just a label [17:50] to identify [17:50] as I told yesterday [17:51] I can have something like github@localhost [17:51] *.* [17:51] ! [17:51] In the long run I can distinguish these keys [17:52] django_master: it all depends on your choice [17:52] next [17:52] what would be good pratice then to use or not to use email id's? [17:53] BhaveshSGupta: your choice [17:53] let me give you an example: [17:53] Suppose I've a Digital Ocean account which is associated with a single email id [17:54] but I spawn up multiple servers through that account [17:54] each of those servers can have a different ssh key [17:55] like in my case one can host blog, other can be weechat, other znc [17:55] since emails are used as labels [17:55] I can use blog@doboxes, znc@doboxes, weechat@doboxes [17:56] Was that clear enough? [17:56] Yes, [17:56] yes [17:56] yes [17:56] [17:56] yes [17:56] servers are nothing but rented remote computers [17:56] :) [17:56] sayan, what you generally do about file name? [17:57] while generating keys [17:57] aniruddhab: use ! first :) [17:57] ok forgot sorry [17:57] aniruddhab use ! To get in queue and ask when batul ask you [17:57] next [17:57] ! [17:58] next [17:58] sayan, what you generally do about file name? [17:58] while generating keys [17:58] I use filenames like znc_do, blog_do etc [17:58] ok [17:59] moving ahead [17:59] so, you know that ssh is a safe way to administer and access remote machines [18:00] ssh uses cryptography to establish the connection, authenticate between two parties, and once it's done you can pass commands [18:01] or rathe a shell opens up for you and you can execute the commands [18:01] so before that I will talk of symmetric encryption, asymmetric encryption and hashing [18:02] (these are really difficult topics to explain in simple words but I will try.) [18:02] ! [18:02] (if there are question and if they divert the class a lot, i will move them to ask after class) [18:02] next [18:03] you said about establishing connection and executing commands but can the connection distinguish b/w who can execute command among the two or both can execute [18:04] so the ssh follows a client server model [18:04] one is the client and other is the server [18:04] client executes the command on the server [18:05] * symmetric encryption * [18:05] [18:06] In symmetric encryption, one key is used between both the client and the server the encrypt the messages [18:07] and also uses the same key to decrypt the messages [18:07] anyone who holds that "one key" can decrypt the messages [18:09] in this type of encryption, the key is called "shared key", "secret key", and few even call "session key" (why session key, I have no clue) [18:10] when this key is built the client and server both contribute towards building the key [18:10] and no one other than these participating machines know about the key [18:10] ! [18:10] ! [18:10] the process to generate the secret key is known as key exchange algorithm [18:11] # task for the session: learn what is key exchange algorithk [18:11] s/algorithk/algorithm [18:12] but as core you need to know that the client and server contribute towards establishing this key and resulting secret is not known to other parties [18:12] read about deffie-hellman key exchange algorithm in a blog [18:13] next [18:13] who is chosen as the client and who is chosen as the server in case of symmetric encryption? [18:14] How is it chosen? [18:15] suppose gargantua_kerr[m you need to buy a candy whose cost is 10 USD [18:15] and you are two friends who went to the shop to buy the candy [18:16] so one friend contribute 5, and you contribute the other 5 [18:16] The same thing happens when generating the key, both contribute equally [18:17] but if we think from a user perspective, if you use a remote machine, you would be the client, and the machine you are accessing is the server [18:17] next [18:17] In symmetric encryption the key can be private or public? or only public? [18:17] raydeeam: what do you think? [18:18] private i think [18:18] why not public? [18:19] only i can access the private key [18:19] ! [18:19] may I? [18:19] next [18:19] go ahead [18:19] single key if made public is like a leaked password . anyone can decrypt the information [18:20] ! [18:20] in symmetric encryption we use the same key to encrypt as well decrypt the data. That is why it has to be private [18:20] exactly, you encrypt put in a password to your safe, and then go ahead and distribute the password to the public [18:20] anyone now can open the sage [18:20] s/sage/safe [18:20] next [18:20] The key which is created in symmetric encryption, does it hold validity for a certain period of time? [18:21] gandalfdwite: good question, I'm not sure maybe we can search later [18:21] okay, sayan [18:22] but what I think is they shared key is valid for the duration of the connection [18:22] okay, I'll search more on it then. [18:22] thanks! [18:22] going ahead [18:23] * asymmetric encryption * [18:23] in asymmetric encryption, for sending data in one direction two keys are needed [18:23] one is known as the private key [18:24] the other as the public key [18:24] the public key can be freely shared to public [18:24] can someone give an instance when did we share the public key? [18:24] ! [18:24] next [18:24] github account [18:25] yesterday, for GitHub ssh auth [18:25] Yes [18:26] the public and private key are paired keys, but the private key in no manner can be derived from public key [18:26] basically private key is private, and should remain private [18:27] if a message needs to be encrypted then you use the receiver's public key and it can only be decrypted by receivers private key [18:27] ! [18:27] suppose zarnigma and iinternaut are working on this very classified project, each of them have a a private-public key pair [18:28] and now zarnigma wants to send their app admin password to iinternaut [18:28] so zarnigma would encrypt it with iinternaut public key and send the encrypted message to iinternaut [18:28] and then iinternaut would decrypt the message with the private key [18:29] any questions till here? [18:29] nope [18:29] ! [18:30] ! [18:30] ! [18:30] sayan: Nope [18:30] next [18:30] ! [18:31] next [18:31] so basically public key can only be used to decrypt, and private can do both encrypt and decrypt [18:31] ? [18:31] nope [18:31] public key is only for encrypt and private is only for decrypt [18:31] ! [18:32] okay gotcha thanks [18:33] next [18:33] these private-public keys are related to each other, however they cannot be derived from each other . How is that maintained? How public-private key pairs are decided? [18:34] zarnigma: Mathematics does that, but my maths foo is not that strong [18:34] may be we all can sit someday and try to understand [18:34] okay will google it... it is done in the client side right? like we generated pair of keys yesterday [18:35] or are there any cases where server has a role to generate those key pairs? [18:35] there is a algorithm, called RSA algorithm [18:36] in RSA algorithm, you take two very large prime numbers, P & Q [18:37] and then you few operations like multiplication to find public key [18:37] (and then bunch of other operations happen which I really don't recall) [18:38] anyways you can search easily on the internet [18:38] sure will do that. Thanks [18:38] goinext [18:38] next [18:38] zarnigma can encrypt it with iinternaut public key. but while decrypting it iinternut need the private key. It's the inbuilt mechanism? like who's public key i used to encrypt the file only his private key can decrypt the file right? [18:39] raydeeam: yes [18:39] no other private key would work [18:39] okay [18:40] raydeeam: also be try to be gender neutral in your sentences [18:40] next [18:40] got the answer [18:40] yeah sorry for that. [18:40] next [18:41] Suppose I send a message to my friend's machine in asymmetric encryption. So the private keys of my friends will be required to decrypt the message. Is the information stored somewhere in the message about my friends private key? Since the public key is used to encrpyt the message, how does it know which key decrpyts it? [18:41] because public-private is a pair [18:42] the public key you use, the private key of that pair can only encrypt it [18:43] next [18:43] sayan: does public key pair up with both the private keys? [18:43] what do you mean by both private keys? [18:43] there is only one private key [18:45] sayan: The two people who are communicating will have their own private key, right? [18:45] ! [18:45] i can give the ans [18:45] ! [18:45] raydeeam: sure go ahead [18:45] next [18:46] like i want to send sayan a file. i'll use sayan's public key to encrypt it [18:46] the public key know about private key that's why github auth asking for private key password while testing. right? [18:46] and sayan will decrypt the file using his private key [18:46] after giving the public key to the github [18:47] sayan: am i right? [18:47] raydeeam: yes [18:47] gargantua_kerr[m: did you understand the raydeeam's example [18:48] Yes. Thanks raydeeam ! [18:48] next [18:48] the public key know about private key that's why github auth asking for private key password while testing. right? [18:48] after giving the public key to the github [18:48] Github never asks for any password [18:49] gargantua_kerr[m question is far more deep raydeeam, If the keys are different then how it gets decrypted? [18:49] I guess I will take another class to explain how these things interact [18:50] aniruddhab: but to answer your question [18:50] github intializes the process, it's your local machine itself which asks for your password to decrypt the message github sent [18:51] aniruddhab must be talking about paraphrase github asks while testing the connection [18:51] mrinalraj_: gargantua_kerr[m: different in the sense? sayan's private-public keys will be different. my private public keys will be different [18:51] zarnigma: I'm talking of the same, that passphrase is the password to your open the private key [18:52] sayan, ok understood [18:52] zarnigma, yes [18:52] I've no clue what mrinalraj_ meant [18:52] anyways ending the class here [18:53] Read about the types of encryption I discussed today [18:53] and the key exchange algorithm [18:53] also you can read about RSA algorithm [18:53] raydeeam: Yeah. both of us will have different private keys, right? so will the public key pair up with both of them in an alternate way when message is sent to two-way? [18:54] gargantua_kerr[m: how can a message be sent in two-way? [18:55] if I already have the message why would I need that message back from the other party [18:55] Roll Call [18:55] Pravar Agrawal [18:55] gargantua_kerr[m: i want to send sayan a file. only he can access the file that's why i'll use sayan's public key. and sayan'll decrypt it using his private key. here i'll not use any of my private or public key in order to send a file to sayan. [18:55] Jagannathan Tiruvallur Eachambadi [18:55] sayan, what about hashing? [18:55] Rayan Das [18:55] kumar Prateek [18:55] vibhor [18:55] Aniruddha Basak [18:56] sayan: Let me rephrase it. I'm sending a message to you, the public key will pair up with your private key and ou private key will decrypt it. When you send a instruction to my mqachine, the public key will pair up with my private key to devrypt the message. Is that what is happening? [18:56] Pritam [18:56] Nilesh Patra [18:56] Ritik Raushan [18:56] do we need to study that too?^^ [18:56] Abhay Kaushik [18:56] sparsh [18:57] iinternaut: nope, not need to study hashing [18:57] Kuntal Majumder ----END CLASS----